icedid | b3791ea2bce069a6a17d518c6b62e08273a0f7bcdc023536a71af7210722cccc | Triage™

Analysis

max time kernel
12s
max time network
106s
platform
windows10_x64
resource
win10v20201028
submitted
16/03/2021, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IcedID.dll
Size 43KB
Sample210316-3ebap5t8ta
SHA256 b3791ea2bce069a6a17d518c6b62e08273a0f7bcdc023536a71af7210722cccc
MD5 0c72ab9a9056aa37eaca9d0be5ee30cf
SHA1 061fe160f7b96da8f01b245425a56a9792605ed6
SHA512 3262e3d43bcec777447b822fc57a202b6b10818b7d2b7c7d75ea6ab900cf8ef9733b09d6fe9fe9e206aa8a371b35cd4d480d84dce072a058dedb71f01de85730
MD5 SHA1 SHA512

Score

10^/10

icedid 3557290534 banker loader trojan

Malware Config

Extracted

Family

icedid

Campaign

3557290534

C2

33nachoscocso.website

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 1 IoCs

resource	yara_rule
behavioral2/memory/1100-2-0x0000000001000000-0x0000000001007000-memory.dmp	IcedidFirstLoader

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1100	regsvr32.exe
1100	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\IcedID.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-2-0x0000000001000000-0x0000000001007000-memory.dmp

Download